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Abstract 

In 1986, Saks and Wigderson conjectured that the largest separation between determin¬ 
istic and zero-error randomized query complexity for a total boolean function is given by 
the function / on n = 2^ bits defined by a complete binary tree of NAND gates of depth k, 
which achieves i?o(/) = We show this is false by giving an example of a to¬ 

tal boolean function f on n bits whose deterministic query complexity is n{n/ log(n)) while 
its zero-error randomized query complexity is 0{y/n). We further show that the quantum 
query complexity of the same function is giving the first example of a total function 

with a super-quadratic gap between its quantum and deterministic query complexities. 

We also construct a total boolean function g onn variables that has zero-error randomized 
query complexity ri(n/log(n)) and bounded-error randomized query complexity R{g) = 
0{y/n). This is the first super-linear separation between these two complexity measures. 
The exact quantum query complexity of the same function is Qsig) = 0{y/n). 

These two functions show that the relations D{f) = 0(i?i(/)^) and i?o(/) = 0{R{f)^) 
are optimal, up to poly-logarithmic factors. Further variations of these functions give ad¬ 
ditional separations between other query complexity measures: a cubic separation between 
Q and i?o, a 3/2-power separation between Qe and R, and a 4th power separation between 
approximate degree and bounded-error randomized query complexity. 

All of these examples are variants of a function recently introduced by Gobs, Pitassi, 
and Watson which they used to separate the unambiguous 1-certificate complexity from 
deterministic query complexity and to resolve the famous Clique versus Independent Set 
problem in communication complexity. 
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1 Introduction 


Query complexity has been very useful for understanding the power of different computational 
models. In the standard version of the query model, we want to compute a boolean function 
/: {0,1}” {0,1} on an initially unknown input x G {0,1}” that can only be accessed by asking 

queries of the form Xi =1. The advantage of query complexity is that we can often prove tight 
lower bounds and have provable separations between different computational models. This is in 
contrast to the Turing machine world where lower bounds and separations between complexity 
classes often have to rely on unproven assumptions. At the same time, the model of query 
complexity is simple and captures the essence of quite a few natural computational processes. 

We use D{f), R{f) and Q{f) to denote the minimum number of queries in deterministic, 
randomized and quantum query algorithm^ that compute /. It is easy to see that Q{f) < 
R{f) < R{f) for any function /. For partial functions (that is, functions whose domain is a 
strict subset of {0,1}”), huge separations are known between all these measures. For example, 
a randomized algorithm can tell if an n-bit boolean string has 0 ones or at least n/2 ones with 
a constant number of queries, while any deterministic algorithm requires n(n) queries to do 
this. Similarly, Aaronson and Ambainis [T] recently constructed a partial boolean function / 
on n variables that can be evaluated using one quantum query but requires 0(-y/n) queries for 
randomized algorithms. 

The situation is quite different for total functions!! Here it is known that D{f), R{f), and 
Q{f) are all polynomially related. In fact, D{f) = 0{R{f)^) [18] and D{f) = 0{Q{f)^) |3|. 
A popular variant of randomized algorithms is the zero-error (Las Vegas) model in which a 
randomized algorithm always has to output the correct answer, but the number of queries after 
which it stops can depend on the algorithm’s coin flips. The complexity Ro{f) is defined as the 
expected number of queries, over the randomness of the algorithm, for the worst case input x. 
A tighter relation D{f) < i?o(/)^ is known for Las Vegas algorithms (this was independently 
observed by several authors [laElEs]). Nisan has even shown D{f) = 0(i?i(/)^) [T8|, where 
i?i(/) is the one-sided error randomized complexity of /. Recently, Kulkarni and Tal |14j . 
basing on a result by Midrijanis m, showed that Ro{f) = 0{R{f)‘^), where the O notation 
hides poly-logarithmic factors. 

While it has been widely conjectured that these relations are not tight, little progress has 
been made in the past 20 years on improving these upper bounds or exhibiting functions with 
separations approaching them. Between D{f) and R(){f), the best separation known for a total 
function is the function NAND^ on n = 2^ variables defined by a complete binary NAND tree of 
depth k. This function satisfies Ro(NAND^) = 0(L)(NAND^)°''^^^^"') |22|- Saks and Wigderson 
showed that this upper bound is optimal for NAND^, and conjectured that this is the largest 
gap possible between Ro{f) and D{f) [2U|. This function also provides the largest known gap 
between R{f) and D{f), and satisfies ii(NAND^) = H(i?o(NAND^)) [2T]. This situation points 
to the broader fact that, as far as we are aware, no super-linear gap is known between R{f) and 
Ro{f) for a total function /. Between Q{f) and D{f), the largest known separation is quadratic, 
given by the OR function on n bits, which satisfies Q{f) = 0{y/n) [T2| and D{f) = H(n). 

1.1 Our results 

We improve the best known separations between all of these measures. In particular, we show 
that 

^By default, we use R{f) and Q{f) to refer to bounded-error algorithms (i.e., algorithms that compute f{x) 
correctly on every input x with probability at least 9/10). 

^In the rest of the paper we will exclusively talk about total functions. Hence, we sometimes drop this 
qualification. 
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• There is a function / with Ro{f) = 0{D{f)^/‘^). This refutes the nearly 30 year old 
conjecture of Saks and Wigderson [20], and shows that the upper bounds D{f) < i?o(/)^ 
and D{f) = 0{Ri{f)‘^) are tight, up to poly-logarithmic factors. 

• There is a function / with Ri{f) = 0{Ro{fy^‘^). This is also nearly optimal due to Nisan’s 
result D{f) = 0{Ri{f)‘^), as well as the upper bound Roif) = 0{R{f)‘^) by Kulkarni and 
Tab Previously, no super-linear separation was known even between R{f) and Rq^J). 

• There is a function / with Q{f) = 0{D(f)^^^). This is the first improvement in nearly 
20 years to the quadratic separation given by Grover’s search algorithm m- 

• Let QeH) be the exact quantum query complexity, the minimal number of queries needed 
by a quantum algorithm that stops after a fixed number of steps and outputs f{x) with 
^obability 1. We exhibit functions /i, /2 for which (5 e(/i) = 0(-Ro(/i)^^^) and Q_b(/ 2 ) = 
0(i?(/2)^/^). This improves the best known separation of Ambainis from 2011 [2| giving 
an / for which Q{f) = 0{R{f)^'^^’^'"). Prior to the work of Ambainis, no super-linear 
separation was known, the largest known separation being a factor of 2, attained for the 
PARITY function [9|. 

A full list of our results are given in the following table. Subsequent to our work, Ben-David 
[Ij has additionally given a super-quadratic separation between Q{f) and R{f), exhibiting a 
function with Q{f) = 0{R{f)‘^^^). 



lower bound for all / 

previous separation 

this paper 

function 

result 

Roif) 

L!(II(/)V2) [T3i 0 g3] 

O(ZI(/)0-753...j 

m 

0(ZI(/)V2) 

f2n,n 

Corollary [7| 

Qif) 

mif)^'^) 0 

0(ZI(/)V2) 

m 

0(ZI(/)V4) 

f2n,n 

Corollary [7| 

Riif) 

moif)^/^)m 

OiRoif)) 


0(Ro(/)'/') 

9n,n 

Corollary [TTI 

QeU) 

moif)^^^)m 

OiRoif)^-^^^- 

)m 

OiRoif)^^) 

9n,n 

Corollary [TT| 

Qif) 

moif)^/^)m 

OiRoif)^/^) 

m 

OiRoif)^^) 

h o 

Corollary [T9| 

QeU) 

mif)^^^) [El 

O{R{f)0-S07...) 

m 

0(R(/)2/3) 

^1,71, 

Corollary [21] 

deg(/) 

mif)^^^) [3] 

0(R(/)V2) 

m 

0(R(/)V4) 

^l,n,n2 

Corollary |23| 


Other separations can be obtained from this table using relations between complexities in 
Figured 

1.2 G66s-Pitassi-Watson function 

All of our separations are based on an amazing function recently introduced by Goos, Pitassi, 
and Watson m to resolve the deterministic communication complexity of the Clique vs. Inde¬ 
pendent set problem, thus solving a long-standing open problem in communication complexity. 
They solved this problem by first solving a coresponding question in the query complexity 
model and then showing a general “lifting theorem” that lifts the hardness of a function in 
the deterministic query model to the hardness of a derived function in the model of determin¬ 
istic communication complexity. In the query complexity model, their goal was to exhibit a 
total boolean function / that has large deterministic query complexity and small unambiguous 
1-certificate complexity!! 

subcube is the set of strings consistent with a partial assignment Xi^ = bi,, Xi^ = bs. Its length is s, the 
number of assigned variables. The unambiguous 1-certificate complexity is the smallest s such that can 

be partitioned into subcubes of length s (whose corresponding partial assignments are consequently 1-certificates 
of /). See Section [2] for full definitions. 
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The starting point of their construction is the boolean function /: {0, l}'^ —>■ {0,1} with the 
input variables Xij arranged in a rectangular grid M = [n] x [m]. The value of the function is 1 
if and only if there exists a unique all-1 column. The deterministic complexity of this function 
is n(nm), since it is hard to distinguish an input with precisely one zero in each column from 
the input in which one of the zeroes is flipped to one. It is also easy to construct a 1-certificate 
of length n + m — 1: Take the all-1 column and one zero from each of the remaining columns. 
This certificate is not always unique, however, as there can be multiple zeroes in a column and 
any of them can be chosen in a certificate. Indeed, it is impossible to partition the set of all 
positive inputs into subcubes of small length. 

Goos et al. added a surprisingly simple ingredient that solves this problem: pointers to cells 
in M. One can specify which zero to take from each column by requiring that there is a path 
of pointers that starts in the all-1 column and visits exactly one zero in all other columns, see 
Figured! Thus, the set of positive inputs breaks apart into a disjoint union of subcubes of small 
length. Since the pointers provide great flexibility in the positioning of zeroes, this function is 
still hard for a deterministic algorithm. 



Figure 1: An example of a 1-certificate for the Goos-Pitassi-Watson function. The center of a 
cell Xij shows val{xij) and the top right corner shows point(xjj) 

Formally, the definition of the Goos-Pitassi-Watson function is as follows. Let n and m be 
positive integers, and M = [n]x [m] be a grid with n rows and m columns. Let M = ML) {T}. 
Elements in M are considered as pointers to the cells of M, where T stands for the null pointer. 

The function gn^m ■ ({0,1} x M)^ {0,1} is defined as follows. We think of each tuple 

V = {b,p) G {0,1} X M in the following way. The element b G {0,1} of the pair is the value and 
the second element p G M is the pointer. We will use the notation val(u) = b and point(u) = p. 

Although gn,m is not a boolean function, it can be converted into an associated boolean 
function by encoding the elements of the input alphabet S = {0,1} x M using [log |S|] bits. 

An input evaluates to 1 if and only if the following three conditions are satisfied 

(see Figured! for an illustration); 

1. There is exactly one column b such that val(xi^b) = 1 for all i G [n]. We call this the 
marked column. 

2. In the marked column, there exists a unique cell a such that Xa 7 ^ (IjT). We call a the 
special element. 
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3. For the special element a, by following the pointers inductively defined as pi = point(xa) 
and Ps+i = point(xp^) for s = 1 ,... ,m — 2 we visit every column except the marked 
column, and val(a:p^) = 0 for each s = 1,..., m — 1. We call pi, ... ,Pm-i the highlighted 
zeroes. 

For each positive input x, the all-1 column satisfying items (1) and (2) of the definition, and 
the highlighted zeroes from (3) give a unique minimal 1-certificate of x. Thus, the unambiguous 
1-certificate complexity of this function is n -|- m — 1. Goos et al. showed that this function 
has deterministic query complexity mn, giving a quadratic separation between the two when 
n = m. 

1.3 Our technique and pointer functions 

As described in the previous section, Goos et al. showed how pointers can make certificates 
unambiguous without substantially increasing their size. This technique turns out to be quite 
powerful for other applications as well. 

Using the Goos-Pitassi-Watson function, it is already possible to give a larger separation 
between randomized and deterministic query complexity than previously known. For instance, 
Mukhopadhyay and Sanyal m, independently from our work, obtained separations R{f) = 
0{y^D{f)) and Ro{f) = C){D{f)^/^). However, these algorithms are rather complicated, and it 
is not known whether this function can realize an optimal separation between Roif) and D{f). 

We instead modify the Goos-Pitassi-Watson function in various ways. For the separation 
between Rq and D the key new idea we add is the use of back pointers] for the separation 
between Q and D, in addition to back pointers, we further replace the path of zeroes in the 
Goos-Pitassi-Watson function with a balanced tree whose leaves are the highlighted zeroes; 
finally, we consider a modification of the Goos-Pitassi-Watson function where there are multiple 
marked columns for the separation between Q and Rq. We now describe our modifications in 
more detail. 

Back pointers A back pointer points either to a cell in M or to a column in [m]. For instance, 
in order to get a quadratic separation between i?o(/) and D{f), we require that each highlighted 
zero points back to the marked (all-1) column. It turns out that this function is still hard for 
a deterministic algorithm. A randomized algorithm, on the other hand, can take advantage of 
the back pointers to quickly find the all-1 column, if it exists. The algorithm begins by querying 
all elements in a column. Let Z be the set of zeroes in this column and B{Z) be the set of 
columns pointed to by the back pointers in Z. If the value of function is 1, B{Z) must contain 
the marked column. However, B{Z) may also contain pointers to non-marked columns. We 
estimate the number of zeroes in each column of B[Z) by sampling. If we find a zero in every 
column of B{Z), then we can reject the input. On the other hand, we can tune the sampling 
so that if no zero is found in a column c G B{Z), then, with high probability, c has at most 
\Z\/2 many zeroes. We then move to this column c and repeat the process. Even if c is not 
marked, we have made progress by halving the number of zeroes, and, in a logarithmic number 
of repetitions, we either hnd the marked column or reject. 

In this way, back pointers to the marked column from the highlighted zeroes make the 
function easy for an Rq algorithm, but hard for a deterministic one. Similarly, if we only 
require that at least half of the highlighted zeroes point back to the special element a from 
condition (2), the function becomes hard for Rq, but easy for Ri. 

Making partial functions total From another vantage point, the pointer technique can 
essentially turn a partial function into a total one. This is beneficial as it is easy to prove 
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separations for a partial function. Let us describe our separation between Monte Carlo and Las 
Vegas query complexities as an indicative example. 

It is easy to provide a separation between R{f) and Ro{f) for partial functions. For example, 
consider the following partial boolean function f on m variables. For x G {0,1}™, the value of 
f{x) is 1 if the Hamming weight \x\ > m/2, and f{x) = 0 if \x\ = 0. Otherwise, the function 
is not defined. The Monte Carlo query complexity of this function is 0(1), but its Las Vegas 
complexity is m/2 + 1, since it takes that many queries to reject the all-0 string. 

How can we obtain a total function with the same property that there are either exactly 
0 or at least m/2 marked elements? We define a variant of the Goos-Pitassi-Watson function, 
where we require that, in a positive input, at least m/2 of the highlighted zeroes point back to 
the special element a of condition (2). Consider an auxiliary function / on the columns of the 
grid M. For a column j G [m], f{j) = 1 if and only if the value of the original function is 1, 
and the highlighted zero in column j points back to a. Thus, by definition, either /(j) = 0 for 
all j, or f{j) = 1 for at least half of all j G [m]. Given a column j, we can find a by analyzing 
the back pointers contained in column j. When a is found, it is easy to test whether the value 
of the function is 1 and the highlighted zero in column j points to a. Moreover, this procedure 
can be made deterministic and uses only 0{n + m) queries. 

Subsequent to our work, Ben-David [1] devised a different way of converting a partial func¬ 
tion into a total one, and applied it to the forrelation problem [T] to give a function / with 
Q{f) = 0{R{f)'^^^), the first super-quadratic separation between these measures. 

Use of a balanced tree Instead of a path through the highlighted zeroes as in condition (3) 
of the Goos-Pitassi-Watson function, we use a balanced binary tree with the zeroes being the 
leaves of the tree. This serves at least three purposes. 

First, this allows for even greater flexibility in placing the zeroes. As they are the leaves of 
the tree, they are not required to point to other nodes. This helps in proving Las Vegas lower 
bounds. 

Second, the tree allows “random access” to the highlighted zeroes. This is especially helpful 
for quantum algorithms. After the algorithm finds the marked column, it should check the 
highlighted zeroes. The last element of the path can be only accessed in m queries. But if we 
arrange the zeroes in a binary tree, each zero can be accessed in only a logarithmic number of 
queries, hence, they can be tested in 0{y/m) queries using Grover’s search. 

Finally, it can make the function hard even for a Monte Garlo algorithm (if no back pointers 
are present). In the original Goos-Pitassi-Watson function, when a randomized algorithm finds 
a highlighted zero, it can follow the path starting from that cell. As the zeroes are arranged in 
a path, the algorithm can thus eliminate half of the potential marked columns on average. This 
fact is exploited by the algorithm of Mukhopadhyay and Sanyal m- 

Similarly, when an algorithm finds a node of the tree it can also explore the corresponding 
subtree. The difference is that the expected size of a subtree rooted in a node of the tree is 
only logarithmic. Thus, even if the algorithm finds this node, it does not learn much, and we 
are able to prove an H(nm/log m) lower bound for a Monte Garlo algorithm. 

In principle, all of the above problems can be solved by adding direct pointers from the 
special element (a in condition (2)) to a zero in each non-marked column (that is, using an 
{m — l)-ary tree of depth 1 instead of a binary tree of depth O(logm)). The problem with 
this solution is that the size of the alphabet becomes exponential, rendering this construction 
useless for boolean functions. 

Choice of separating functions We have outlined above three ingredients that can be 
added to the original Goos-Pitassi-Watson function: using various back pointers, identifying 
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unmarked columns by a tree of pointers, and increasing the number of marked columns. These 
ingredients can be added in various combinations to produce different effects. In order to reduce 
the number of functions introduced, in this paper we stick to three variations: 


• a function fn,m with back pointers to the marked column from each of the highlighted 
zeroes. 

• a function gn,m with back pointers to the special element from half of the highlighted 
zeroes, and 

• a function hk^n,m with k marked columns and no back pointers. 

All three functions use a balanced binary tree. 

This does not mean that a given separation cannot be proven with a different combination 
of ingredients. For example, as outlined above, the Rq vs D separation can be proven for the 
original Goos-Pitassi-Watson function by equipping each highlighted zero with a back pointer 
to the marked column and not using the binary tree. 

2 Preliminaries 

We let [n] = {1,2,..., n}. We use /(n) = 0{g{n)) to mean that there exists constants c, k and 
an integer N such that |/(n.)| < c\g{n) \ log^(n) for all n > N. 

In the remaining part of this section, we define the notion of query complexity for various 
models of computation. For more detail on this topic, the reader may refer to the survey [5]. 
Relations between various models are depicted in Figure [2j 


R -^ Ri -> Ro 



Figure 2: Relations between various complexities. An arrow means that complexity on the left 
is at most the complexity on the right. 

Deterministic query complexity Let S be a finite set. A decision tree T on n variables 
and the input alphabet S is a rooted tree, where 

• internal nodes are labeled by elements of [n]; 

• every internal node v has degree |S| and there is a bijection between the edges from v to 
its children and the elements of S; 

• leaves are labeled from {0,1}. 

The output of the decision tree T on input x G TR, denoted T(x), is determined as follows. 
Start at the root. If this is a leaf, then output its label. Otherwise, if the label of the root is 
z G [n], then follow the edge labeled by Xi (this is called a query) and recursively evaluate the 
corresponding subtree. We say that T computes the function /: S” —)• {0,1} if T{x) = f{x) 
on every input x. The cost of T on input x, denoted C(T,x), is the number of internal nodes 
visited by T on x. The deterministic query complexity D[f) of / is the minimum over all 
decision trees T computing / of the maximum over all x of C{T,x). 
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Randomized query complexity We follow the definitions for randomized query complexity 
given in [211 [E]. A randomized decision tree is defined by a probability distribution ^ over 
deterministic decision trees. On input x, a randomized decision tree first selects a deterministic 
decision tree T according to /r, and then outputs T{x). The expected cost of on input x is 
the expectation of C{T,x) when T is picked according to fi. The worst-case expected cost of 

is the maximum over inputs x of the expected cost of on input x. 

There are three models of randomized decision trees that differ in the definition of “com¬ 
puting” a function /. 

• Zero-error (Las Vegas): It is required that the algorithm gives the correct output with 
probability 1 for every input x, that is, every deterministic decision tree T in the support 
of jjL computes /. 

• One-sided error: It is required that negative inputs are rejected with probability 1, and 
positive inputs are accepted with probability at least 1/2. 

• Two-sided error (Monte Carlo): It is required that the algorithm gives the correct output 
with probability at least 9/10 for every input x. 

The error probability in the one-sided and two-sided cases can be reduced to e by repeating 
the algorithm 0(log ^) times. 

We define randomized query complexities Ro{f), Ri{f), and R{f) as the minimum worst- 
case expected cost of a randomized decision tree to compute / in the zero, one-sided, and 
bounded-error sense, respectively. 

Distributional query complexity A common way to show lower bounds on randomized 
complexity, and the way we will do it in this paper, is to consider distributional complexity [24j . 
The cost of a deterministic decision tree T with respect to a distribution u, denoted C{T, v), is 
¥,x-i^v[C{T, x)\. The decision tree T computes a function / with distributional error at most 5 
if Pra;^jy[T(x) = f{x)] > 1 — J. Finally, the d-error distributional complexity of T with respect 
to V, denoted j^(/), is the minimum of C{T, v) over all T that compute / with distributional 
error at most 6. 

Yao has shown the following: 

Theorem 1 (Yao [23j). For any distribution v and a function f, Ro{f) A o,nd R{f) > 

1^2/10,uif)- 

In general, Yao shows that the d-error randomized complexity of a function / is at least 
^A 2 S,u{f), for any distribution u. We obtain the constant ^ on the right hand side as we have 
defined R{f) for algorithms that err with probability at most 

Quantum query complexity The main novelty in a quantum query algorithm is that queries 
can be made in superposition. For this exposition we assume S = [|S|] (this identification can be 
made in an arbitrary way). The memory of a quantum query algorithm contains two registers, 
the query register Hq which holds two integers j G [n] and p G T, and the workspace H]y 
which holds an arbitrary value. A query on input x is encoded as a unitary operation Ox in the 
following way. On input x and an arbitrary basis state \j,p) |tc) G Hq (g) H\y, 

Ox\j,p) |w^) = \j,P + Xj mod |S|) |u;) . 

A quantum query algorithm begins in the initial state |0,0) |0) and on input x proceeds by 
interleaving arbitrary unitary operations independent of x and the operations Ox- The cost of 


the algorithm is the number of applications of Ox- The outcome of the algorithm is determined 
by a two-outcome measurement, specified by a complete set of projectors {no,ni}. If iTa,) 
is the final state of the algorithm on input x, the probability that the algorithm outputs 1 is 
||ni|'I'a;)|P- The exact quantum query complexity of the function /, denoted QeH), is the 
minimum cost of a quantum query algorithm that outputs f{x) with probability 1 for every 
input X. The bounded-error quantum query complexity of the function /, denoted Q{f), is the 
minimum cost of a quantum query algorithm that outputs f{x) with probability at least 9/10 
for every input x. 

We will describe our quantum algorithms as classical algorithms which use the following 
well-known quantum algorithms as subroutines. Let Ox be a quantum oracle encoding a string 
X G {0,1}”. 

• Grover’s search mw- Assume it is known that \x\ > t. There is a quantum algorithm 
using 0{-\/n/t) queries to Ox that finds an i such that x, = 1 with probability at least 
9/10. 

• Exact Grover’s search [6]. Assume it is known that |x| = t. There is a quantum algorithm 
using 0{^n/t) queries to Ox that finds an i such that x* = 1 with certainty. The case 
f = n/2 is essentially the Deutsch-Jozsa problem |TU] . 

• Approximate counting [7]: Let t = |x|. There is a quantum algorithm making 0{y/n) 
queries to Ox that outputs a number i satisfying \i — t\ < with probability at least 
9/10. 

• Amplitude amplification [6]: Assume a quantum algorithm A prepares a state |'i/) = 
0^0 |0) IV’o) + cki |1) IV’i)) where V’o and ^pl are unit vectors, and oq and ai are real 
numbers. Thus, the success probability of A, i.e., probability of obtaining 1 in the first 
register after measuring \'ip), is 

Assume a lower bound p is known on a\. There exists a quantum algorithm that makes 
0{1/y/p) calls to A, and either fails, or generates the state |1) \'ipi). The success probability 
of the algorithm is at least 9/10. 

In all of these quantum subroutines, the error probability can be reduced to e by repeating 
the algorithm 0(log times. 

Polynomial degree Every boolean function /: {0,1}” —?■ {0,1} has a unique expansion as a 
multilinear polynomial p = X]5c[n] Flies The degree of /, denoted deg(/), is the size of 
a largest monomial xs in p with nonzero coefficient as- The approximate degree of /, denoted 
deg(/), is ^ 

deg(/) = min {deg( 5 r) | \g{x) - /(x)| < T for all x G (0, 1}”} . 

Eor any quantum algorithm that uses T queries to the quantum oracle Ox, its acceptance 
probability is a polynomial of degree at most 2T [3]. Therefore, deg(/) < 2QE{f) and deg(/) < 

2Q(/). 

Certificate complexity A partial assignment in S” is a string in a G (SU {*})”. The length 
of a partial assignment is the number of non-star values. A string x G S” is consistent with 
an assignment a if Xj = ai whenever a* A *• Every partial assignment defines a subcube, which 
is the set of all strings consistent with that assignment. For every subcube there is a unique 
partial assignment that defines it, and we define the length of a subcube as the length of this 
assignment. 
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For b E {0, 1}, a b-certificate for a function /; S” —)• {0,1} is a partial assignment such that 
the value of / is 6 for all inputs in the associated subcube. The b-certificate complexity of / is 
the smallest number k such that the set f~^{b) can be written as a union of subcubes of length 
at most k. The unambiguous b-certificate complexity of / is the smallest number k such that 
the set f~^{b) can be written as a disjoint union of subcubes of length at most k. 

Booleanizing a function While we define functions over a nonboolean alphabet S, it is more 
typical in query complexity to discuss boolean functions. Fix a surjection b: {0, — )• S. 

For a function f: T,^ ^ {0)1}) we define the associated boolean function f: {0, 

(0, 1} by /(x) = f{b{x)). A lower bound on / in the model where a query returns an element 
of S will also apply to / in the model where a query returns a boolean value. Also, if / can 
be computed with t queries then we can convert this into an algorithm for computing / with 
t [log |S|] queries by querying all the bits of the desired element. We will state our theorems 
for nonboolean functions where a query returns an element of S and the alphabet size |S| will 
always be polynomial in the input length. By the remarks above, such separations can be 
converted into separations for the associated boolean function with a logarithmic loss. 

3 Separations against deterministic complexity 

Let n, m, M, M be as in the definition of the Goos-Pitassi-Watson function. Let also C = 
[m] U (Tj be the set of pointers to the columns of M. The input alphabet of our function is 
S = {0,1} X M X M X C. For u E S, we call the elements of the quadruple the value, the 
left pointer, the right pointer and the back pointer of v, respectively. We use notation val(u), 
Ipoint(u), rpoint(u), and bpoint(u) for them in this order. 




Figure 3: A completely balanced tree on 8 leaves, and a balanced tree on 11 leaves. 

Let T be a fixed balanced oriented binary tree with m leaves and m — 1 internal vertices. 
For instance, we can make the following canonical choice. If m = 2^ is a power of two, we use 
the completely balanced binary tree on m leaves as depicted in Figure [3] on the left. Each leaf is 
at distance k from the root. Otherwise, assume 2^ < m < Take the completely balanced 

tree on 2^ leaves, and add a pair of children to each of its m — 2^ leftmost leaves. An example 
is in Figure [3] on the right. 

We have the following labels in T. The outgoing arcs from each node are labeled by ‘left’ 
and ‘right’. The leaves of the tree are labeled by the elements of [m] from left to right, with 
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each label used exactly once. For each leaf j E [m] of the tree, the path from the root to the 
leaf defines a sequence of ‘left’ and ‘right’ of length O(logm), which we denote T{j). 

The fnnction fn,m- {0,1} is defined as follows. For an input x = {xij), we have 

fn,m{x) = 1 if and only if the following conditions are satisfied (for an illustration refer to 
Figure HI); 

1. There is exactly one column b E [m] snch that val(xj^6) = 1 for all i E [n]. We refer to it 
as the marked column. 

2. In the marked column, there exists a uniqne cell a snch that Xa ^ (1,T,T,T). We call a 
the special element. 

3. For each non-marked column j E let be the end of the path which starts at the 

special element a and follows the pointers Ipoint and rpoint as specified by the sequence 
T{j). We require that Ij exists (no pointer on the path is T), Ij is in the jih. column, and 
val(x£^) = 0. We call Ij the leaves of the tree. 

4. Finally, for each non-marked column j E [m] \ {b}, we reqnire that bpoint(a;£^.) = b. 



Figure 4: An example of a 1-certificate for the function /g^g. The tree T is like in Figure [3] 
on the left. The center of a cell Xij shows val(xjj), the bottom of the cell shows bpoint(xjj) 
and the bottom left and right sides show Ipoint(xjj) and rpoint(xjj), respectively. Values and 
pointers that are not shown can be chosen arbitrarily. 

Theorem 2. Ifn = 2m and m is sufficiently large, the deterministic query complexity D{fn,m) > 
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m . 

Proof. We describe an adversary strategy that ensures that the value of the function is unde¬ 
termined after queries, provided m > 4. Assume a deterministic query algorithm queries a 
cell {i,j). Let k be the number of queried cells in column j, inclnding the cell (i,j). If A; < m, 
the adversary replies with (1, T, T, T). Otherwise, the response is (0, T, T, A: — m). 

Note that, after all the cells are queried in some column, it contains m cells with (1, T, T, T) 
and one cell with (0, T, T, 6) for each b E [m]. 

Claim 3. If there is a column b E [m] with at most m queried cells and there are at least 4m 
unqueried cells in total, then the function value is undetermined. 
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Proof. First, the adversarial strategy is such that no all-one column can ever be constructed, 
hence, by answering all remaining queries with value 0, the adversary can make the function 
evaluate to 0. 

Now we show that the function value can also be set to 1. For each column j ^ b, define ij 
as follows. If column j contains an unqueried cell let ij = and assign the quadruple 

(0, _L, _L, b) to this cell. If all elements in column j were queried, then, by the adversary strategy, 
it contains a cell with quadruple (0, ±,±,6). Let ij be this cell. 

Next, the queried cells in column b only contain (I, -L, -L, -L). Assign the quadruple (1, X, X, X) 
to the remaining cells in column b except for one special cell a. Using the cell a as the root 
construct a tree of pointers isomorphic to T using as internal vertices some of the remaining 
unqueried cells, and such that the jth leaf is ij. Finally, assign the quadruple (1,X,X,X) to 
every other cell. 

To carry out the construction above, we need m — 2 unqueried cells outside of column b and 
the set of ijS to place the internal vertices of the tree. Since there are 2m cells in column b and 
m — I cells are used by ijS, it suffices to have 4m unqueried cells to do this. □ 

It takes more than m^ queries to ensure that each column contains more than m queried 
cells. As 2m^ — 4m > m^ when m > 4, we obtain the required lower bound. □ 


Algorithm 1 A Las Vegas randomized algorithm for the function fn,m 

VerifyColumn(j) tests whether column j is marked 

1. If column j does not satisfy condition (2) of the definition of fn,m, then reject. Otherwise, 
let a be the special element. 

2. Following the left and right pointers from a and querying the elements along the way, 
check that the tree rooted at a satisfies conditions (3) and (4) of the definition of fn,m- If 
it does, accept. Otherwise, reject. 

TestColumn(c, k) always returns ‘True’ if column c has no zeroes. If it has more than k/2 
zeroes, returns ‘False’ with probability > I — I/(nm)^. Returns anything in the intermediate 
cases. 

I. Query 0{j log(nm)) random elements from column c. If no zero was found, return ‘True’. 
Otherwise, return ‘False’. 

Main procedure of the algorithm 

1. Let j be an arbitrary column in [m], and k n. 

2. Repeat the following actions: 

(a) Query all the elements of column j. If all of them have value I, VerifyColumn(j). 

(b) If column j contains more than k zeroes, then query all the elements of M and output 
the value of the function. 

(c) Else, let C be the set of nonnull back pointers stored in the zero elements of column 
j. For each c £ C, TestColumn(c, k). If ‘False’ is obtained for all the columns, reject. 
Otherwise, let j be any column with outcome ‘True’. 

(d) If /c = 0, reject. Otherwise, let k ^ [k/2\ , and repeat the loop. 


Theorem 4. The Las Vegas randomized complexity Ro{fn,m) = 0{n + m). 
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Proof. For the description, see Algorithm [TJ With each iteration of the loop in step 2, k gets 
reduced by half until it becomes zero, hence, after O(logn) iterations of the loop, the algorithm 
terminates. 

Let us check the correctness of the algorithm. The algorithm only accepts from the procedure 
VerifyColumn which verifies the existence of a 1-certificate. Thus, the algorithm never accepts 
a negative input. 

To see the algorithm always accepts a positive input, let the input x be positive with marked 
column b. Consider one iteration of the loop in step 2. If j = b, then the algorithm accepts in 
VerifyColumn(j) on step 2(a). Now assume j ^ b. Then, column j contains a zero with a back 
pointer to b, hence, the algorithm does not reject on step 2(c). The algorithm also does not 
reject on step 2(d) since, when A: = 0, the condition in 2(b) applies. 

Let us now estimate the expected number of queries made by the algorithm. Condition 
in step 2(b) is obviously not satisfied on the first iteration of the loop. On a specific later 
iteration, the probability this condition is satisfied is at most l/(rem)^ by our definition of 
TestColumn(c, A:). Since the loop is repeated O(logn) times, the contribution of step 2(b) to 
the complexity of the algorithm is o(l). 

If step 2(b) is not invoked, we have the following complexity estimates. VerifyColumn 
uses 0{m) queries, and it is called at most once. Apart from VerifyColumn, Step 2(a) uses n 
queries. Since \C\ < A; on step 2(c), the number of queries in this step is 0{n). Since there 
is only a logarithmic number of iterations of the loop in step 2, the total number of queries is 
0{n + m). □ 

Theorem 5. The quantum query eomplexity Q{fn,m) = 0{y/n + y/m). 

Proof. The algorithm. Algorithm [2l is a quantum counterpart of Algorithm [TJ We assume 
that every elementary quantum subroutine of the algorithm (e.g. Grover’s search or quantum 
counting) is repeated sufficient number of times to reduce its error probability to at most 
l/(nm)^. This requires a logarithmic number of repetitions, which can be absorbed into the O 
factor. Since the algorithm makes less than 0{n + m) queries, we may further assume that all 
the elementary quantum subroutines are performed perfectly. 

The analysis is similar to Theorem HJ Again, the algorithm only accepts from VerifyColumn, 
which is called at most once. The three steps of VerifyColumn correspond to the three conditions 
defining a 1-input. Any negative input violates one of these conditions, and thus will fail one 
of these tests. 

Now suppose we have a positive input x with marked column b. In this case, each non- 
marked column contains a zero with a back pointer to the marked column b. We want to argue 
that the algorithm accepts x with high probability. The following claim is the cornerstone of 
our analysis. 

Claim 6. If the input x is positive and eolumn j eontains at most zeroes, then step 2(b) of 
the algorithm finds a eolumn c containing at most k/2 zeroes with high probability. 

Proof. We first claim that FindGoodBackPointer(j, k) returns ‘True’ with probability at least 
1/2A:. Indeed, we assumed that the probability Grover’s search on step 1 fails is negligible. 
Thus, with high probability, before execution of step 2, v is chosen uniformly at random from 
the at most ^A: zeroes in column j. One of these zeroes has a back pointer to the marked 
column b. If it is chosen, step 3 returns ‘True’ with certainty, which proves our first claim. 

Thus, amplitude amplification in step 2(b) of the main procedure will generate the ‘True’- 
portion of the final state of the FindGoodBackPointer subroutine. Again, since we assume that 
the error probability of Grover’s search on step 3 of FindGoodBackPointer is negligible, we may 
assume this portion of the state only contains columns c with at most k/2 zeroes. □ 
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Algorithm 2 A quantum algorithm for the function fn,m 

VerifyColumn(j) tests whether column j is marked 

1. Use Grover’s search to find an element a in column j with nonnull left or right pointer. 
If no element found, reject. If val(xa) = 0, reject. 

2. Use Grover’s search to verify that all elements in column j except a are equal to 
(1,_L,_L,±). If not, reject. 

3. Use Grover’s search (over all j G to check that conditions (3) and (4) of the 

definition of fn,m are satisfied. If they are, accept. Otherwise, reject. 

FindGoodBackPointer(j, k) if column j has < zeroes and one of them has a back pointer 
to an all-1 column, finds a column containing < k/2 zeroes with probability > l/2k. 

1. Use Grover’s search to find a zero v in column j. 

2. If bpoint(x^) = X, return ‘False’. Otherwise c •(— bpoint(x^). 

3. Execute Grover’s search for a zero in column c, assuming there are > k/2 of them. Return 
‘False’ if Grover’s search finds a zero, and ’True’ otherwise. 

Main procedure of the algorithm 

1. Let j be an arbitrary column in [m]. 

2. Repeat the following actions. If the loop does not finish after 10 log n iterations, reject. 

(a) Use quantum counting to estimate the number of zeroes in column j with relative 
accuracy 1/10. Let k be the estimate. If A: = 0, VerifyColumn(j). 

(b) Execute quantum amplitude amplification on the FindGoodBackPointer(j, k) sub¬ 
routine amplifying for the output ‘True’ of the subroutine and assuming its success 
probability is at least 1/2A:. Let c be the corresponding value of the subroutine after 
amplification. 

(c) Set j •(— c. Repeat the loop. 


Consider the loop in step 2. We may assume quantum counting is correct in step 2(a). 
If j = b, then VerifyColumn(j) is called in step 2(a), and the algorithm accepts with high 
probability. So, consider the case j ^ b. Column j contains a zero, hence, with high probability, 
VerifyColumn is not executed on step 2(a). Thus, by Claim [6l the number of zeroes in column 
j gets reduced by a factor of 1.1/2. Therefore, after 10 log n iterations, the number of zeroes in 
column j becomes zero, which means j = b, and the algorithm accepts with high probability. 

We now estimate the complexity of the algorithm. Steps (1) and (2) of VerifyColumn take 
0{y/n) queries. For step (3) of VerifyColumn, we have to check that the tree of pointers 
rooted from Xa satisfies conditions (3) and (4) from the definition of fn,m- We can check the 
correctness of a single path from the root to a leaf with O(logm) (classical) queries. Since there 
are m many paths, checking them all with Grover’s search takes 0{y/rn) many queries. Overall, 
VerifyColumn takes 0{^/n + ^/m) queries. 

Grover’s search in FindGoodBackPointer(j, A:) uses 0{y/n/k) queries. Since the success 
probability of FindGoodBackPointer(j, fe) is at least 1/2A:, amplitude amplification repeats 
FindGoodBackPointer(j, A:) 0{-\/k) times and the complexity of step 2(b) is 0{y/n). Quan¬ 
tum counting in step 2(a) also uses 0{y/n) queries. 

Since we run the main loop at most O(logn) many times, the total complexity of the 
algorithm is 0{y/n + ^/rn). □ 
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Corollary 7. There is a total boolean function f with Ro{f) = 0{D{f)^/^) and Q{f) = 
0(Z)(/)V4). 

Proof. We first obtain these separations for a non-boolean function. Take fn,m with n = 
2m. Then the zero-error randomized query complexity is 0{n) by Theorem [H the quantum 
query complexity is 0{^/n) by Theorem [Sj and the deterministic query complexity is Q{n‘^) by 
Theorem O Since the size of the alphabet S is polynomial, this also gives the separations for 
the associated boolean function /2m,m- Cl 

4 Separations against Las Vegas complexity 

In this section, we define a variant of the fn,m function from the last section. Let n, m, M, M, 
T and T{j) be as previously. The input alphabet is S = {0,1} x M x M x M, where we keep 
the names and notation of left, right and back pointers. Note that the back pointers now point 
to a cell of M, not a column. 

Let m be even. The function gn,m '■ {0,1} is defined like the function fn^m in Section[3] 

with condition 4 replaced by the following condition 

4' The set G = G [ \ {^} I bpoint(x£^.) = «} is of size exactly m/2. 

For an illustration refer to Figure [5j 



Figure 5: An example of a 1-certificate for the function The tree T is like in Figure [3] 
on the left. The center of a cell Xij shows val(xij), the bottom of the cell shows bpoint(xjj) 
and the bottom left and right sides show Ipoint(xjj) and rpoint(xjj), respectively. Values and 
pointers that are not shown can be chosen arbitrarily. It is crucial that m/2 leaves point to the 
root a of the tree, and m/2 — 1 leaves point to something different. 

Theorem 8. If n and m are sufficiently large, the Las Vegas randomized query complexity 

Ro{9n,ra) = Il{nm). 

Proof. We construct a hard probability distribution on negative inputs such that any Las Vegas 
randomized algorithm has to make 12(nm) queries in expectation to reject an input sampled 
from it. Each input x = {xij) in the hard distribution is specified by a function ■ [w,] —>■ [n]. 
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The function specifies the positions of the leaves of the tree T in a possible positive instance. 
The definition of x is as follows 

J(0,T,T,T), iff = 4(i); 

Xi i = \ ( 1 ) 

|^(1,T,T,T), otherwise. 

The hard distribution is formed in this way from the uniform distribution on all functions 4- 
Thus, all pointers are null pointers, and each column contains exactly one zero element in a 
random position. The theorem obviously follows from the following two results. □ 

Claim 9. Any Las Vegas algorithm for the function gn,m, can reject an input x from the hard 
distribution m only if it has found at least m/2 zeroes or it has queried more than n{m—l) — 2m 
elements. 

Lemma 10. Assume a Las Vegas algorithm can reject an input x from the hard distribution m 
only if it has found Ll{m) zeroes or it has queried Ll{nm) elements. Then, the query complexity 
of the algorithm is VL{nm). 

Proof of Claim\^ Assume these conditions are not met. Then, we can construct a positive 
input y that is consistent with the answers to the queries obtained by the algorithm so far. 

Let B C [m] be the set of columns where no zero was found. By assumption, \B\ > m/2 + 1. 
Choose an element b ^ B and a subset G V B \ {b} of size m/2. Define a = {ixib),b), set the 
value of Pa to 1 and its back pointer to T. For each column j E G, define = (0, T,T,a). 

Finally, for the remaining columns j G B \ {GL) {5}), define ye,,{j),j = (0,T,T,T). 

Remove from the tree T the leaf with label b. Let the resulting graph be T'. Put the 
root of T' into a, and, for each j / b, put the leaf of T' with label j into (4(i),/)• Put the 
remaining nodes of T' into the still unqueried cells of M preserving the structure of the graph. 
Set their values to 0 and their back pointers to T. Set all the remaining cells to (!,+,+,+). 
The resulting input y is positive and consistent with the answers to the queries obtained by the 
algorithm. □ 

Proof of Lemma \1(A By Theorem [T] it suffices to show that any deterministic algorithm B makes 
an expected Vt{nm) number of queries to find D(m) zeroes in an input from the hard distribution. 

Consider a node S of the decision tree T). Call a column j E [m] compromised in S if either 
a zero was found in it, or more than n/2 of its elements were queried. For an input x, let At{x) 
be the number of compromised columns on input x after t queries. Similarly, let Bt{x) be the 
number of queries made outside the compromised columns. Let us define 

It{x) = At{x) + -Bt{x). 

n 

Note that At{x) can only increase as t increases, whereas Bt{x) can increase or decrease. 
Claim 11. For a non-negative integer t, we have 

Ex[lt+iix)] -Ex[ltix)] < ( 2 ) 

where the expectation is over the inputs in the hard distribution. 

Proof. Fix t. We say two inputs x and y are equivalent if they get to the same vertex of the 
decision tree after t queries. We prove that ([2|) holds with the expectation taken over each of 
the equivalency classes. Fix an equivalence class, let x be an input in the class, and (i, j) be the 
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variable queried by V on the {t + l)st query on the input x. Note that (i, j), At{x) and Bt{x) 
do not depend on the choice of x. 

Consider the following cases, where each case excludes the preceding ones. All expectations 
and probabilities are over the uniform choice of an input in the equivalence class. 

• The jth. column is compromised. Then It+i{x) = Itix), and we are done. 

• After the cell (i,j) is queried, more than half of the cells in the jih. column have been 
queried. Then, At{x) increases by 1, and Bt{x) drops by [n/2j. Hence, ¥.x\lt+i (a:)] < 
^x[lt{x)] + 1 /n. 

• Consider the remaining case. We have Y'lxli = ^xij)] < 2/n. If i = lx{j), then At{x) 

grows by 1, and Btix) can only decrease. If i 7 ^ ^xii), then At(x) does not change, and 
Bt{x) grows by 1. Thus, Ex[lt+i{x)] - Ex[lt{x)] < f + ^ = |. □ 

Now we finish the proof of Lemma fTUl Assume the algorithm can reject an input x only if 
it has found cim zeroes or it has queried C 2 nm elements for some constants ci,C 2 > 0. 

Let t = [cirem/ 8 j. Clearly, IEa;[Io(x)] = 0 for all x. Claim ITT] implies Ea;[/i(x)] < ciml2. 
By Markov’s inequality, VTx\lt{x) > cim] < 1/2. By our assumption, the probability the 
algorithm T) has not rejected x after t' = min{t, C 2 nm} queries is at least 1/2. Hence, the 
expected number of queries made by the algorithm is at least t' /2 = Vt{nm). □ 

Theorem 12. For one-sided error randomized and exact quantum query complexity, we have 
Ri{9n,m) = 0{n + m) and QE{9n,m) = 0{n + m). 

Proof. For a positive input x, we call a column j G [m] good iff it belongs to the set G from 
Condition 4' on Page [T21 Thus, a positive input has exactly m/2 good columns, whereas a 
negative one has none. Theorem [12] follows immediately from the following lemma. 

Lemma 13. There exists a deterministic subroutine that, given an index j G [m], accepts iff 
the column j is good m 0 (n + m) queries. 

Indeed, given a string y G {0,1}™, it takes 0(1) queries for either an Ri or a Qe algorithm to 
distinguish the case y = 0™ from the case when y has exactly m/2 ones. Using the subroutine 
from Lemma as the input to this algorithm, we evaluate the function gn,m in 0 (n + m) 
queries. 

For example, for an algorithm with one-sided error, we choose an index j G [m] uniformly 
at random, and execute the subroutine of Lemma [T3l If the input is negative, we always reject. 
If the input is positive, we accept with probability exactly 1/2. The exact quantum algorithm 
is obtained similarly, using the Deutsch-Jozsa algorithm. □ 

Proof of Lemma \1A The subroutine is described in Algorithm [S] In the subroutine, I stores 
the set of (the first indices) of the cells in column j that can potentially contain the element (.j 
back pointing to the special element a. The set B contains potentially marked columns. 

As ensured by step 4, the subroutine only accepts if the input is positive (column b passes 
the verification), and the column j is good. Hence, we get no false positives. On the other hand, 
assume the input is positive with the marked column b, column j is good, and ij = {i,j). In 
this case, i cannot get removed from I due to goodness of column j and Condition 3 on Page [HI 
and b never gets eliminated from B as it contains no zeroes. Thus, the only possibility to exit 
the loop on step 2 is to have B = {b}. In this case, b passes the verification, and the algorithm 
accepts since column j is good. Hence, we get no false negatives as well. 

The query complexity of each iteration of the loop in step 2 is O(logm). Also, with each 
iteration, either I or B get reduced by one element. Hence, the total number of iterations of 
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Algorithm 3 A deterministic subroutine testing whether a column j is good 

1. Let I [n] and B ■(r- [m], 

2. While 1/0 and \B\ > 2, repeat the following: 

(a) Let i be the smallest element of I. Let a bpoint(xjj). If o = _L, remove i from I, 
and continue with the next iteration of the loop. 

(b) Let j be the smallest number of a column in B that does not contain a. Follow the 
pointers from a as specihed by the sequence T(j). Let ij be the endpoint. 

(c) If ij exists, is located in column j and its value is 0, remove j from B. Otherwise, 
remove i from I. 

3. If \B\ > 2, reject. Otherwise, let b be the only element of B. Verify column b using a 
procedure similar to that in Algorithm [TJ 

4. If column b passes the verification, and j belongs to the set G from Condition 4' on 
PageHni accept. Otherwise, reject. 


the loop does not exceed n + m. Finally, the verification in step 3 requires 0{n + m) queries. 
Thus, the query complexity of the algorithm is 0{n + m). □ 

Corollary 14. There is a total boolean function f with Ri{f) = and QeU) = 

0{Ro{fY/‘^). 

Proof. We first obtain this separation for a non-boolean function. Take gn,m with n = m. The 
one-sided error randomized and exact quantum query complexity is 0{n) by Theorem 1121 and 
the Las Vegas query complexity is O(n^) by Theorem [ 8 l Since the size of the alphabet S is 
polynomial, this also gives the separations for the associated boolean function gn,n- Cl 

5 Other separations against randomized complexity 

In this section we define another modification of the function used in Section [3l Let n, m, 
M, M and T be as in Section [3l and let A; : 1 < A: < m be an integer. The new function 
hk^n,m '■ —)• {0,1} is defined as follows. The input alphabet is S = {0,1} x M x M x M. 

For u G S, we call the elements of the quadruple the value, the left pointer, the right pointer 
and the internal pointer of Xjj, respectively. We use notation val(u), Ipoint(u), rpoint(u), and 
ipoint(u) for them in this order. 

For an input x = (xij), we have hk^n,mix) = 1 if an only if the following conditions are 
satisfied (for an illustration refer to Figure [ 6 ]) : 

1. There are exactly k columns bi,... ,bk such that val(xj_ 6 j = 1 for all i G [n] and each 
s G [A:]. We refer to these as the marked columns. 

2. Each marked column bg contains a unique cell Og such that Xa„ 7 ^ (1, T, T, T). We call Ug 
a special element. 

3. We have ipoint(a:a,j) = a^+i for all s G [A: — 1], and ipoint(xaj.) = ai. Also, lpoint(a:a,j) = 
lpoint(xaJ and rpoint(xa^) = rpoint(xat) for all s,t G [k]. 

4. For each non-marked column j G [m] \ {bi,..., bk}, let ij be the end of the path which 
starts at a special element Ug (whose choice is irrelevant) and follows the pointers Ipoint 
and rpoint as specified by the sequence T{j). We require that ij exists (no pointer on the 
path is T), ij is in the jth column, and wa\.{x^.) = 0 . 
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Figure 6: An example of a 1-certificate for the /is^g^g function. The tree T is like in Figure [3] on 
the left. The center of a cell Xjj shows val(xij), the top of the cell shows ipoint(xij) and the 
left and right sides show Ipoint(xij) and rpoint(xij), respectively. Values and pointers that are 
not shown can be chosen arbitrarily. 


We use this function in two different modes. The first one is the k = 1 case. Then, hi^n,m 
is essentially the fn,m function from Section [3] with the back pointers removed, i.e., it need not 
satisfy condition (4). In this mode, the function is hard for a Monte Carlo algorithm, but still 
has low approximate polynomial degree. 

The second mode is the general k case. In this mode, the function is hard for a Las Vegas 
algorithm, but feasible for quantum algorithms. The proof of the lower bound is similar to 
Section m We need a different function because Algorithm [3] in Theorem fT2l cannot be efficiently 
quantized. 

Theorem 15. If n and m are sufficiently large, the Las Vegas randomized query complexity 
Ro{hk,n,m) = Ll{nm) for any k < m/2. 

Proof. The proof is similar to the proof of Theorem [51 We define the hard distribution ([T]) in 
exactly the same way. The theorem follows from Lemma [10] and the following claim. □ 

Claim 16. Any Las Vegas algorithm for the function hk^n,m can reject an input x from the hard 
distribution m only if it has found m — k + 1 zeroes or it has queried more than n{m — k) — 2m 
elements. 

Proof. Assume these conditions are not met. Then, we can construct a positive input y that is 
consistent with the answers to the queries obtained by the algorithm so far. 

Indeed, choose a set = {bi,... ,6^} of columns where no zero was found. Define Og = 
{llx{bs),bs) for each s E [k]. These elements have not been queried yet. Define val(ya,,) = 1 for 
all s, as well as ipoint(y(i,,) = Og+i for all s E [A; — 1], and ipoint(yaj,) = ai. 

Remove from the tree T the leaves with labels in B and the root. Let the resulting graph 
be T'. For each j ^ B, put the leaf of T' with label j into set its value to 0 and 

all pointers to T. Put the remaining nodes of T' into the still unqueried cells of M preserving 
the structure of the graph. Set their value to 0 and their internal pointers to T. Let u and 
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V be the cells where the left and the right child of the root of T went. For each s E [k], set 
lpoint(?/as) = u and rpoint(yas) = v. Set all the remaining cells to (1,_L,±,±). The resulting 
input is positive, and consistent with the answers to the queries obtained by the algorithm. □ 

Theorem 17. If n and m are sufficiently large, the randomized query complexity R{hi^n,m) = 

“UogmT 

Note that Theorem 1171 only considers the case k = 1. It is proven in a similar fashion to 
Theorem da using the additional fact that the expected size of a subtree rooted in a node of a 
balanced tree is logarithmic. The proof is given in Section 0 

5.1 Quantum versus Las Vegas 

Theorem 18. The quantum query complexity Q{hk,n,m) = 0{^y/nm/k + \/^ + k + y/m). 

Proof. We search for a column consisting only of ones using Grover’s search. Testing one column 
takes 0{y/n) queries. Also, in the positive case, there are k such columns, so we will find one 
after 0{y/nm/k) queries with high probability. If we do not find such a column, we reject. 

In case we find a marked column j, we use Grover’s search to check that it satisfies condition 
(2) of the definition of hk^n,m- This requires 0{y/n) queries. Let a be the corresponding special 
element. We follow the internal pointer from a to find all the special elements and to check that 
condition (3) of the definition of hk^n,m is satisfied. This requires k queries. We use Grover’s 
search to check that all the remaining elements of the marked columns are equal to (1, T, T, T). 
This requires 0{Vkn) queries. 

After that, we check condition (4) of the definition of hk,n,m- Since there are less than m 
elements Ij to check and each one can be tested in O(logm) queries, Grover’s search can check 
this condition in 0{y/rn) queries. □ 

Corollary 19. There is a total boolean function f with Q{f) = 0{Ro{f)^^^). 

Proof. We first obtain the separation for a non-boolean function. Take hk^n,m with k = n and 
m = n^. Then the quantum complexity is 0(n) by Theorem 1181 and the Las Vegas randomized 
complexity is by Theorem 1151 Since the size of the alphabet S is polynomial, we obtain 

the required separations for the associated boolean function. □ 


5.2 Exact Quantum versus Monte Carlo 


Theorem 20. The exact quantum query complexity QE{hk,n,m) = 0{ny/m/k + kn + m). 

Proof. We use the exact version of Grover’s search to find a column consisting only of ones. In 
the positive case, there are exactly k such columns, and testing each column takes n queries. 
Thus, the complexity of this step is 0{nyjm/k). 

If we find a marked column j, we query all Xij for i E [n] to check that it satisfies condition (2) 
of the definition of hk,n,m- Let a be the corresponding special element. We follow the internal 
pointer from a to check that condition (3) is also satisfied and to hnd all the marked columns. 
We then check condition (2) on them as well. All this requires kn queries. 

After that, we follow the left and right pointers from a, and check that condition (4) of the 
definition of hk,n,m, is satished. This requires 0{m) queries. □ 

Corollary 21. There exists a total boolean function f with QEif) = 0{R{f)‘^^^). 
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Proof. Take with m = m?. Then the exact quantum query complexity is 0(n‘^) by 

Theorem [20] and the Monte Carlo randomized query complexity is 12 (n^) by Theorem [T71 Since 
the size of the alphabet S is polynomial, this also gives the separation for the associated boolean 
function hi^n,m- Cl 

5.3 Approximate Polynomial Degree versus Monte Carlo 

Theorem 22. Let hi^n,m'- {0,1^11 ^ {0,1} be the boolean function associated to hi^n,m- 
The approximate polynomial degree deg{hi^n,m) = 0(^/n + y/m) 

Proof. For j E [m], let gj : {0, |o, 1} be defined as follows. The value gj{x) is 1 

if hi^ri,m{x) = 1, and j is the marked column. Otherwise, gj{x) = 0. 

For each j E [m], the function gj{x) can be evaluated in 0{y/n + y/rn) quantum queries using 
a variant of the VerifyColumn procedure in Algorithm [21 Repeating this quantum algorithm 
O(logm) times, we may assume that its error probability is at most l/(10m). We then use 
the connection between quantum query algorithms and polynomial degree of [3] to construct a 
polynomial Pj{x) of degree 2T (where T is the number of queries) that is equal to the acceptance 
probability of this algorithm. The polynomial Pj{x) is of degree 0{y/n + y/m) and satisfies 
0 < Pj{x) < l/(10m) if gj{x) = 0, and 1 — l/(10m) < Pj{x) < 1 otherwise. 

We then define a polynomial p{x) = YhjPji^)- = 0, then all gj{x) = 0 and 

0 < p{x) < 1/10. Otherwise, there is unique b E [m] such that gb{x) = 1, and all other gj{x) = 0. 
In this case, 1 — l/(10m) < p{x) < 11/10. Thus, p{x) is an approximating polynomial to hi^n,m 
and its degree is 0{y/n + y/m). □ 

Corollary 23. There is a total boolean function f with deg(/) = 0{R{f)^^^). 

Proof. Take hi^n,m from Theorem 1221 with m = n. Then the approximate degree is 0{y/n), and 
the Monte Carlo randomized query complexity is by Theorem 1171 □ 

6 Proof of Theorem [T7 

Lemma 24. Assume T is a balanced binary tree with m leaves, and at least a 1/4 fraction of 
its nodes are marked. Let u be sampled from all the marked nodes of T uniformly at random. 
The expected size of the subtree rooted at u does not exceed Cq logm for some constant Cq. 

Proof. Let us first consider the case when T is a complete balanced binary tree with 2^ — 1 
nodes and all its nodes are marked. Then, the expected size of the subtree is (where i is the 
height of the node u) 

E5r7T'F-i)<'=. (3) 

i=l 

In the general case, T can be embedded into a complete balanced binary tree T' with 2^ — 1 
nodes, where k = [logm] + 1. Mark in T' all the nodes marked in T. Again, an 12(1) fraction of 
the nodes is marked. Hence, for each node u, a probability that u is sampled from the marked 
nodes of T' is at most a constant times its probability to be sampled from all the nodes of T'. 
Thus, the expected size of the subtree is at most a constant times the value in ([3D. □ 

By Theorem [H it suffices to construct a hard distribution on inputs and show that any 
deterministic decision tree that computes with distributional error less than 2/10 on the 

hard distribution makes an 12(nm/logm) expected number of queries. By Markov’s inequality. 
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it suffices to show that any deterministic decision tree that performs this task with error 3/8 
has depth VL{nm/ \ogm). We now define the hard distribution. 

Let T be the balanced binary tree from the definition of hi^n,m- Denote by r the root of the 
tree, and by the set of internal nodes of T. The latter has cardinality m — 1. 

An input x = (xij) is dehned by a quadruple {vx,Trx,£];.,£^), where 

• Vx G { 0 , 1 }, it will be the value of the function hi^n,m on x; 

• TTx '■ [m\ is an injection, it specifies to which columns the internal nodes of T will 

go; and 

• [m\ [n] and : [m] —)■ [n] are functions satisfying P^{j) 7 ^ for each j G [m]. 

They specify the rows where the leaves and the internal nodes of the tree T land in column 

j- 

The definition is as follows. Remove the leaf with the label Trx(r) from T. For each column 
j / put the leaf j into the cell set all its pointers to T and its value to 0 . 

Then, for each internal node u of the tree, put it at (P^{'Kx{u)).,tTx{u)) ■, set its left and right 
pointers so that the structure of the tree is preserved. If u / r, assign its internal pointer to T, 
and set its value to 0. Otherwise, if u = r, assign its internal pointer to itself, and set its value 
to Vx- Assign the quadruple (1, T, T, T) to all other cells. It is easy to see that the value of the 
function hi^n,m on this input is Vx- 

The hard distribution is dehned as the uniform distribution over the quadruples (ua,, vTa,, I'J;, 
subject to the constraint ix{j) 7 ^ ^xU) fo^ each j G [m]. 

Let D be a deterministic decision tree of depth 


6 AC 0 log m' 

We will prove that T) errs on x, sampled from the hard distribution, with probability at least 
3/8. 

Let x be an input from the hard distribution, and consider the vertex 5 of D after t queries 
to X. We say that a column j G [m] and the corresponding tree element vrjr^(j) (if it exists) are 
compromised on the input x after t queries if at least one of the following three conditions is 
satished: 

• one of the cells (/),/) and has been queried; 

• more than a half of the cells in the jth column have been queried; or 

• in the tree T there exists an ancestor u of vrjr^(i) such that one of the above two conditions 
is satished for tTx{u). 

Let At{x) denote the number of compromised columns, and Bt{x) denote the number of 
cells queried outside the compromised columns, both after t queries. Consider the following 
quantity 

It{x) = mm I At{x) H- - - Bt{x), — ^ . 

Note that At{x) can only increase as t increases, whereas Bt{x) can increase or decrease. 
Claim 25. For a non-negative integer t, we have 

Ex[lt+i{x)] -Ex[lt{x)] < (4) 

where the expectation is over the inputs in the hard distribution. 
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We will prove Claim [25] a bit later. Now let us show how it implies the theorem. Clearly, 
Io{x) = 0 for all x. Claim [25| implies that E 2 ,[/£)(x)] < m/8. By Markov’s inequality, the 
probability that Id{x) > m/2 is at most 1/4. 

Let x be an input satisfying Id{x) < m/2. Thus, x has less than m/2 compromised columns 
after D queries. In particular, the variable a = [£^{7rx{r)),TTx{r)) , corresponding to the root of 
T, has not been queried. Let y be the input given by (1 — Ua,, vTa,,They only differ in a, 
and hi^n,m{x) / hi^n,m{y)- Hence, the decision tree V errs on exactly one of them. 

This means that T> errs on x sampled from the hard distribution with probability at least 
3/8. 


Proof of Claim We divide the inputs of the hard distribution into equivalence classes, and 
prove that dH holds with the expectation over each of the classes. We say that two inputs x 
and y are equivalent if the following three conditions hold: 

• after t queries, the decision tree P gets to the same vertex on x and y; 

• the set C of compromised columns is the same in x and y, 

• for all j E C, TTf^U) = TTy^U). 

Fix an equivalence class, let x be an input in the class, and (z, j) be the variable queried by V 
on the (t + l)st query on the input x. Note that (z, j), as well as At{x) and Bt{x) do not depend 
on the choice of x. Consider the following cases, where each case excludes the preceding ones. 
All expectations and probabilities are over the uniform choice of an input in the equivalence 
class. 

• We have It{x) = m/2. Then, It+i{x) < m/2, and we are done. 

• The jih. column is compromised. Then It+i{x) = It{x), and we are done. 

• After the cell (z,j) is queried, more than half of the cells in the jth column have been 
queried. As It{x) < m/2, less than half of the columns are compromised. By Lemma [231 
with non-compromised nodes marked, the expected growth of At{x) is at most Cologm. 
On the other hand, the drop in Bt{x) is at least [n/2j. Hence, E 2 ;[/t+i(x)] < Kx[lt{x)]. 

• Consider the remaining case. We have Pra;[z E (/)}] — 

— If z is one of or then, as in the previous case, the expected growth of 

At{x) is at most Cologm, and Bt{x) can only decrease. 

— If z 7 ^ aa;(j), then At{x) does not change, and Bt{x) grows by 1. 


Thus, 


Ea; [it+i (x)] -E^[lt{x)] < - • Co logm + 

L J L J ^ n 


8 Co log m 
n 


□ 
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